Security readout for executives and security teams
Plain-English summary
A Linux kernel network driver cleanup bug can trigger use-after-free during igbvf device probing after a registration failure. The public record does not provide CVSS, confirmed exploitation, or impact beyond kernel memory safety. Business urgency is mainly for environments using affected Linux kernels with Intel igbvf virtual function networking.
Executive priority
Moderate operational priority until local exposure is confirmed. Patch through normal kernel maintenance, escalating for hosts using igbvf in production virtualization. There is no source-backed evidence of active exploitation in the supplied bundle.
Technical view
CVE-2021-47589 is a Linux igbvf_probe error-path flaw. If register_netdev() fails, cleanup can free adapter->rx_ring before free_netdev() walks dev->napi_list, leaving adapter->rx_ring->napi as a stale entry and causing a KASAN-observed use-after-free. Stable kernel commits remove the NAPI entry before freeing rx_ring.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions with the igbvf driver path reachable, typically virtualized Intel gigabit network function environments. The bundle lists affected Linux kernel versions but does not map distribution package versions.
Exploitation context
The CVE record includes KASAN crash evidence from modprobe in QEMU, but no KEV listing and no cited source claiming active exploitation. Treat this as a kernel memory-safety defect with incomplete public exploitability evidence.
Researcher notes
The root cause is cleanup-order mismatch in the probe failure path: netif_napi_add creates a NAPI list entry tied to rx_ring, then rx_ring is freed before free_netdev removes NAPI entries. Evidence is strong for bug mechanics, weaker for real-world exploitability.
Mitigation direction
- Update to a vendor Linux kernel containing the referenced stable fix or downstream equivalent.
- Prioritize hosts that use Intel igbvf virtual function networking.
- Consult Linux distribution advisories for exact package names and fixed builds.
- If patching is delayed, check vendor guidance for supported interim controls.
Validation and detection
- Inventory Linux kernel versions across virtualized and network-intensive systems.
- Confirm whether igbvf is present, loaded, or required on candidate hosts.
- Verify the running kernel includes one referenced stable fix or distributor backport.
- Review crash logs for igbvf_probe, free_netdev, KASAN, or related probe failures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47589 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ffe1695b678729edec04037e691007900a2b2bebCVE reference, Linux
- https://git.kernel.org/stable/c/79d9b092035dcdbe636b70433149df9cc6db1e49CVE reference, Linux
- https://git.kernel.org/stable/c/8d0c927a9fb2b4065230936b77b54f857a3754fcCVE reference, Linux
- https://git.kernel.org/stable/c/cc9b655bb84f1be283293dfea94dff9a31b106acCVE reference, Linux
- https://git.kernel.org/stable/c/8addba6cab94ce01686ea2e80ed1530f9dc33a9aCVE reference, Linux
- https://git.kernel.org/stable/c/74a16e062b23332d8db017ff4a41e16279c44411CVE reference, Linux
- https://git.kernel.org/stable/c/944b8be08131f5faf2cd2440aa1c24a39a163a54CVE reference, Linux
- https://git.kernel.org/stable/c/b6d335a60dc624c0d279333b22c737faa765b028CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.